LOW🇬🇧 English

CVE-2023-52085

CVSS 3.3v3.1pub. 2023-12-29upd. 2024-11-21

Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

  • Wintercms Winter

    APP
    Wintercms
    < 1.2.4
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Path Traversal
CWE
Referencje

Powiązane podatności

CVE-2026-27591CRITICAL9.9PL ✓ten sam produkt

Winter CMS – privilege escalation przez modyfikację ról i uprawnień

CVE-2024-54149HIGH8.4ten sam produkt

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS p...

CVE-2024-29686HIGH7.2ten sam produkt

Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute ...

CVE-2022-39357HIGH8.1ten sam produkt

Winter is a free, open-source content management system based on the Laravel PHP framework. The Snowboard fram...

CVE-2026-22254NONE0ten sam produkt

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Versions of ...

CVE-2023-52085 — LOW 3.3 | CVEbaza.pl